Lock down chromium policy

diskless.pkr.hcl

@@ -324,12 +324,17 @@ build {
       "install -D -m0755 /tmp/kiosk/kiosk-session /usr/local/bin/kiosk-session",
       "install -D -m0644 /tmp/kiosk/kiosk.service /etc/systemd/system/kiosk.service",
       "install -D -m0644 /tmp/kiosk/weston.ini /etc/xdg/weston/weston.ini",
+      # Chromium managed policy: stops the browser phoning home to Google
+      # (sign-in, variations, optimization-guide, component/auto update, metrics,
+      # safe browsing). EPEL chromium reads /etc/chromium/policies/managed/*.json.
+      # Pairs with the hardening flags in kiosk-session.
+      "install -D -m0644 /tmp/kiosk/chromium-kiosk-policy.json /etc/chromium/policies/managed/10-kiosk-lockdown.json",
       # URL from the var (weston renderer is set via --use-pixman in the unit).
       "install -d -m0755 /etc/kiosk",
       "printf 'KIOSK_URL=%s\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
       "chmod 0644 /etc/kiosk/kiosk.env",
       # Label the new files so they survive into the enforcing erofs.
-      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk",
+      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk /etc/chromium",
       # Boot graphical and start the kiosk (replaces the tty1 getty).
       "systemctl enable kiosk.service",
       "systemctl set-default graphical.target",